CVE-2025-6499 - vstakhov libucl ucl_parser.c ucl_parse_multiline_string heap-based overflow

Back Back to CVE browser

MEDIUM

vstakhov libucl ucl_parser.c ucl_parse_multiline_string heap-based overflow

Published Jun 23, 2025

4.8

MEDIUM

CVSS 4.0

EPSS 0.26%

Description

A vulnerability classified as problematic was found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function ucl_parse_multiline_string of the file src/ucl_parser.c. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

Affected products

Vendor Vstakhov Product Libucl Default
n/a
- Version
  0.9.0
  Status
  affected
  Constraints
  -
- Version
  0.9.1
  Status
  affected
  Constraints
  -
- Version
  0.9.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Vstakhov

Libucl

n/a

Version	Status	Constraints
0.9.0	affected	-
0.9.1	affected	-
0.9.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-119

Buffer Overflow

CWE-122

CWE-787

Out-of-bounds Write

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-28741
Advisory
https://github.com/user-attachments/files/19825399/libucl_crash.txt
exploit
https://github.com/vstakhov/libucl/issues/319
exploitissue-trackingIssue Tracking
https://vuldb.com/?ctiid.313615
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.313615
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.601011
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-28741		Advisory
https://github.com/user-attachments/files/19825399/libucl_crash.txt		exploit
https://github.com/vstakhov/libucl/issues/319		exploitissue-trackingIssue Tracking
https://vuldb.com/?ctiid.313615		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.313615		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.601011		third-party-advisoryThird Party AdvisoryVDB Entry